Somalia’s Immigration and Citizenship Agency has confirmed that its electronic visa (e-visa) platform suffered a data breach that exposed personal details of travelers who used the system, following earlier warnings from the United States and United Kingdom. The confirmation came in mid-November after the U.S. Embassy in Mogadishu reported a significant cyberattack against the system, which was launched in September 2025 to centralize visa issuance.
According to advisories from the U.S. and UK embassies and subsequent media reporting, the incident appears to date back to around November 11, 2025, when unidentified attackers are believed to have compromised the e-visa platform. U.S. officials estimate that data on at least 35,000 applicants may have been exposed, potentially including thousands of U.S. citizens. Leaked records circulating on social media reportedly contain names, photographs, dates and places of birth, email addresses, marital status, and home addresses.
Somali authorities have said they are investigating the scope, origin, and impact of the breach and that they intend to notify affected individuals once the probe is complete. At the same time, the government has quietly shifted the e-visa service to a new website, a move that has drawn criticism from some domestic experts who argue that communication around the incident has been insufficiently transparent. The UK embassy has warned travellers that the breach is ongoing and has advised them to consider the risks before applying for an e-visa.
The episode unfolds against a broader political backdrop. The e-visa scheme has been controversial domestically and has fed into tensions between Somalia’s federal government and the self-declared independent region of Somaliland, which rejects visas issued by Mogadishu. Regional media reports suggest that the breach has amplified concerns about data protection, the role of private operators in managing government digital services, and the potential misuse of traveller data by criminal or state-linked actors.
For governments and airlines assessing travel to and from Somalia, the incident illustrates the risk surface introduced by newly deployed digital entry systems that handle sensitive identity data, particularly when governance, oversight, and security testing have not fully matured.
Sources: Al Jazeera, Dawan Africa, Somalia Guardian, Africanews
—
By Ji-seo Kim
